1. Szegedy C, Zaremba W, Sutskever I, Bruna J, Erhan D, Goodfellow I, Fergus R (2013) Intriguing properties of neural networks. In: 2nd International conference on learning representations, ICLR, conference track proceedings. arXiv:1312.6199
2. Goodfellow I J, Shlens J, Szegedy C (2014) Explaining and harnessing adversarial examples. In: 3rd International conference on learning representations, ICLR, conference track proceedings. arXiv:1412.6572
3. Mudrakarta P K, Taly A, Sundararajan M, Dhamdhere K (2018) Did the model understand the question?. In: Proceedings of the 56th annual meeting of the association for computational linguistics (volume 1: long papers). https://doi.org/10.18653/v1/P18-1176. Association for Computational Linguistics (ACL), pp 1896–1906
4. Miyato T, Dai A M, Goodfellow I (2016) Adversarial training methods for semi-supervised text classification. In: 5th International conference on learning representations, ICLR, Conference track proceedings. https://openreview.net/forum?id=r1X3g2_xl
5. Sato M, Suzuki J, Shindo H, Matsumoto Y (2018) Interpretable adversarial perturbation in input embedding space for text. In: Proceedings of the 27th international joint conference on artificial intelligence. https://dl.acm.org/doi/10.5555/3304222.3304371. AAAI Press, pp 4323–4330